feat(adminui): F15.2 batch 4 — closes live-edit forms (Acl/VirtualTag/ScriptedAlarm/Script)

Final batch of F15.2. After this commit every entity surfaced by the
Phase A-D read views has a matching new/edit/delete form.

- AclEdit.razor                /clusters/{id}/acls/{new|aclId}
  - NodePermissions [Flags] enum surfaced as per-bit checkboxes plus
    one-click bundle buttons (ReadOnly / Operator / Engineer / Admin)
  - ScopeKind select + ScopeId free-text target (null = cluster-wide)
- VirtualTagEdit.razor         /virtual-tags/{new|virtualTagId}
  - Trigger validation: enforces at least one of ChangeTriggered or
    TimerIntervalMs is set
- ScriptedAlarmEdit.razor      /scripted-alarms/{new|scriptedAlarmId}
  - AlarmType select with OPC UA Part 9 subtypes
  - MessageTemplate is a textarea (template tokens are server-resolved)
- ScriptEdit.razor             /scripts/{new|scriptId}
  - SHA-256 hash computed from SourceCode on save (operator never sees
    or edits SourceHash directly)
  - InputTextArea now; Monaco syntax editor is a future enhancement

List pages (ClusterAcls / VirtualTags / ScriptedAlarms / Scripts) all
gain New + per-row Edit affordances.

Tally: F15.2 shipped CRUD for 11 entities — Cluster, ClusterNode,
UnsArea, UnsLine, Namespace, DriverInstance, Equipment, Tag, NodeAcl,
VirtualTag, ScriptedAlarm, Script.

All 9 integration tests still green.

src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Pages/ScriptEdit.razor

@@ -0,0 +1,175 @@
+@page "/scripts/new"
+@page "/scripts/{ScriptId}"
+@* Script CRUD. SourceHash is computed automatically from SourceCode on save so the
+   integrity check in v2's deployment pipeline doesn't require operator action. *@
+@attribute [Microsoft.AspNetCore.Authorization.Authorize]
+@rendermode RenderMode.InteractiveServer
+@using Microsoft.AspNetCore.Components.Forms
+@using Microsoft.EntityFrameworkCore
+@using System.ComponentModel.DataAnnotations
+@using System.Security.Cryptography
+@using System.Text
+@using ZB.MOM.WW.OtOpcUa.Configuration
+@using ZB.MOM.WW.OtOpcUa.Configuration.Entities
+@inject IDbContextFactory<OtOpcUaConfigDbContext> DbFactory
+@inject NavigationManager Nav
+
+<div class="d-flex justify-content-between align-items-center mb-3">
+    <h4 class="mb-0">@(IsNew ? "New script" : "Edit script")</h4>
+    <a href="/scripts" class="btn btn-outline-secondary btn-sm">Cancel</a>
+</div>
+
+@if (!_loaded)
+{
+    <p>Loading…</p>
+}
+else if (!IsNew && _existing is null)
+{
+    <section class="panel notice rise"><span class="mono">@ScriptId</span> not found.</section>
+}
+else
+{
+    <EditForm Model="_form" OnValidSubmit="SubmitAsync" FormName="scriptEdit">
+        <DataAnnotationsValidator />
+        <section class="panel rise">
+            <div class="panel-head">Identity</div>
+            <div style="padding:1rem">
+                <div class="row">
+                    <div class="col-md-6 mb-3">
+                        <label class="form-label">ScriptId</label>
+                        <InputText @bind-Value="_form.ScriptId" disabled="@(!IsNew)" class="form-control form-control-sm mono" />
+                    </div>
+                    <div class="col-md-4 mb-3">
+                        <label class="form-label">Name</label>
+                        <InputText @bind-Value="_form.Name" class="form-control form-control-sm" />
+                    </div>
+                    <div class="col-md-2 mb-3">
+                        <label class="form-label">Language</label>
+                        <InputSelect @bind-Value="_form.Language" class="form-select form-select-sm">
+                            <option value="CSharp">CSharp</option>
+                        </InputSelect>
+                    </div>
+                </div>
+            </div>
+        </section>
+
+        <section class="panel rise mt-3">
+            <div class="panel-head">Source</div>
+            <div style="padding:1rem">
+                <InputTextArea @bind-Value="_form.SourceCode" class="form-control form-control-sm mono"
+                               rows="20"
+                               placeholder="// C# expression body — Monaco editor lands in a follow-up." />
+                <div class="form-text">SHA-256 hash is computed automatically on save.</div>
+            </div>
+        </section>
+
+        @if (!string.IsNullOrWhiteSpace(_error)) { <div class="panel notice mt-3" style="border-color:var(--alert)">@_error</div> }
+
+        <div class="mt-3 d-flex gap-2">
+            <button type="submit" class="btn btn-primary" disabled="@_busy">@(IsNew ? "Create" : "Save changes")</button>
+            <a href="/scripts" class="btn btn-outline-secondary">Cancel</a>
+            @if (!IsNew) { <button type="button" class="btn btn-outline-danger ms-auto" @onclick="DeleteAsync" disabled="@_busy">Delete</button> }
+        </div>
+    </EditForm>
+}
+
+@code {
+    [Parameter] public string? ScriptId { get; set; }
+    private bool IsNew => string.IsNullOrEmpty(ScriptId);
+
+    private FormModel _form = new();
+    private Script? _existing;
+    private bool _loaded;
+    private bool _busy;
+    private string? _error;
+
+    protected override async Task OnInitializedAsync()
+    {
+        if (!IsNew)
+        {
+            await using var db = await DbFactory.CreateDbContextAsync();
+            _existing = await db.Scripts.AsNoTracking().FirstOrDefaultAsync(s => s.ScriptId == ScriptId);
+            if (_existing is not null)
+            {
+                _form = new FormModel
+                {
+                    ScriptId = _existing.ScriptId,
+                    Name = _existing.Name,
+                    Language = _existing.Language,
+                    SourceCode = _existing.SourceCode,
+                    RowVersion = _existing.RowVersion,
+                };
+            }
+        }
+        _loaded = true;
+    }
+
+    private async Task SubmitAsync()
+    {
+        _busy = true; _error = null;
+        try
+        {
+            var sourceHash = HashSource(_form.SourceCode);
+            await using var db = await DbFactory.CreateDbContextAsync();
+            if (IsNew)
+            {
+                if (await db.Scripts.AnyAsync(s => s.ScriptId == _form.ScriptId))
+                { _error = $"Script '{_form.ScriptId}' already exists."; return; }
+                db.Scripts.Add(new Script
+                {
+                    ScriptId = _form.ScriptId,
+                    Name = _form.Name,
+                    Language = _form.Language,
+                    SourceCode = _form.SourceCode,
+                    SourceHash = sourceHash,
+                });
+            }
+            else
+            {
+                var entity = await db.Scripts.FirstOrDefaultAsync(s => s.ScriptId == ScriptId);
+                if (entity is null) { _error = "Row no longer exists."; return; }
+                db.Entry(entity).Property(e => e.RowVersion).OriginalValue = _form.RowVersion;
+                entity.Name = _form.Name;
+                entity.Language = _form.Language;
+                entity.SourceCode = _form.SourceCode;
+                entity.SourceHash = sourceHash;
+            }
+            await db.SaveChangesAsync();
+            Nav.NavigateTo("/scripts");
+        }
+        catch (DbUpdateConcurrencyException) { _error = "Another user changed this script while you were editing."; }
+        catch (Exception ex) { _error = ex.Message; }
+        finally { _busy = false; }
+    }
+
+    private async Task DeleteAsync()
+    {
+        if (IsNew) return;
+        _busy = true; _error = null;
+        try
+        {
+            await using var db = await DbFactory.CreateDbContextAsync();
+            var entity = await db.Scripts.FirstOrDefaultAsync(s => s.ScriptId == ScriptId);
+            if (entity is null) { Nav.NavigateTo("/scripts"); return; }
+            db.Entry(entity).Property(e => e.RowVersion).OriginalValue = _form.RowVersion;
+            db.Scripts.Remove(entity);
+            await db.SaveChangesAsync();
+            Nav.NavigateTo("/scripts");
+        }
+        catch (DbUpdateConcurrencyException) { _error = "Another user changed this script while you were viewing it."; }
+        catch (Exception ex) { _error = $"Delete failed: {ex.Message}. Likely because virtual tags or scripted alarms still reference this script — remove them first."; }
+        finally { _busy = false; }
+    }
+
+    private static string HashSource(string source) =>
+        Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(source)));
+
+    private sealed class FormModel
+    {
+        [Required, RegularExpression("^[A-Za-z0-9_-]+$")] public string ScriptId { get; set; } = "";
+        [Required] public string Name { get; set; } = "";
+        [Required] public string Language { get; set; } = "CSharp";
+        [Required] public string SourceCode { get; set; } = "";
+        public byte[] RowVersion { get; set; } = [];
+    }
+}